d0d3f8f40f802fd50927aa0d468abe9c42c21b0e77d600a7c6ccfa8f8b8743fe

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 20:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

94ada8d6dcb6b0fe4370362af2d6e999_JaffaCakes118.exe
Size

23KB
MD5

94ada8d6dcb6b0fe4370362af2d6e999
SHA1

c907fc8f30f2fd06581f2b92b287028bb548ca7b
SHA256

d0d3f8f40f802fd50927aa0d468abe9c42c21b0e77d600a7c6ccfa8f8b8743fe
SHA512

e4fdb12da65666f0bb9197d27df37633dc05ce7950cf4a79c02dec140f616de302c58b31df11ff69c14818cec00d6e2ee29475cafe037ee3a26f1f2f5e14a0f1
SSDEEP

384:zXBj6cjy1kr3xsVM9+a5I1XzvUmeDD/kt/gN9WyWlzOCF74ndnf9qwK:zh6cqee+BUzUhDrBARP6q

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2876	Au_.exe

Loads dropped DLL 4 IoCs

pid	Process
2388	94ada8d6dcb6b0fe4370362af2d6e999_JaffaCakes118.exe
2876	Au_.exe
2876	Au_.exe
2876	Au_.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2388-0-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/files/0x0007000000018716-4.dat	upx
behavioral1/memory/2388-9-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/2876-13-0x0000000000400000-0x0000000000433000-memory.dmp	upx
behavioral1/memory/2876-12-0x0000000000830000-0x0000000000863000-memory.dmp	upx
behavioral1/memory/2876-18-0x0000000000400000-0x0000000000433000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	94ada8d6dcb6b0fe4370362af2d6e999_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2876	Au_.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2876	2388	94ada8d6dcb6b0fe4370362af2d6e999_JaffaCakes118.exe	30
PID 2388 wrote to memory of 2876	2388	94ada8d6dcb6b0fe4370362af2d6e999_JaffaCakes118.exe	30
PID 2388 wrote to memory of 2876	2388	94ada8d6dcb6b0fe4370362af2d6e999_JaffaCakes118.exe	30
PID 2388 wrote to memory of 2876	2388	94ada8d6dcb6b0fe4370362af2d6e999_JaffaCakes118.exe	30
PID 2388 wrote to memory of 2876	2388	94ada8d6dcb6b0fe4370362af2d6e999_JaffaCakes118.exe	30
PID 2388 wrote to memory of 2876	2388	94ada8d6dcb6b0fe4370362af2d6e999_JaffaCakes118.exe	30
PID 2388 wrote to memory of 2876	2388	94ada8d6dcb6b0fe4370362af2d6e999_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\94ada8d6dcb6b0fe4370362af2d6e999_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\94ada8d6dcb6b0fe4370362af2d6e999_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe
  "C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe

Filesize
23KB

MD5
94ada8d6dcb6b0fe4370362af2d6e999

SHA1
c907fc8f30f2fd06581f2b92b287028bb548ca7b

SHA256
d0d3f8f40f802fd50927aa0d468abe9c42c21b0e77d600a7c6ccfa8f8b8743fe

SHA512
e4fdb12da65666f0bb9197d27df37633dc05ce7950cf4a79c02dec140f616de302c58b31df11ff69c14818cec00d6e2ee29475cafe037ee3a26f1f2f5e14a0f1

Download Submit
memory/2388-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2388-1-0x0000000000240000-0x0000000000273000-memory.dmp

Filesize
204KB

Download
memory/2388-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2876-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2876-12-0x0000000000830000-0x0000000000863000-memory.dmp

Filesize
204KB

Download
memory/2876-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2876-20-0x0000000000830000-0x0000000000863000-memory.dmp

Filesize
204KB

Download
memory/2876-21-0x0000000000830000-0x0000000000863000-memory.dmp

Filesize
204KB

Download